The WooCommerce Cloak Affiliate Links plugin suffers from an improper access control vulnerability (CWE-284) because the 'permalink_settings_save' function lacks a capability check. This enables unauthenticated attackers to alter the affiliate permalink base configuration, which can be abused to redirect affiliate links to attacker-controlled destinations. The vulnerability affects all versions up to and including 1.0.33. The CVSS 3.1 base score is 7.5 (High), reflecting network attack vector, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

An attacker can modify the affiliate permalink base without authentication, leading to the redirection of affiliate traffic to malicious sites. This compromises the integrity of affiliate links, potentially causing financial loss and reputational damage to site owners using the plugin. There is no direct confidentiality or availability impact reported. No known exploits in the wild have been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, site administrators should consider disabling the plugin or restricting access to plugin settings via other means. Monitoring for plugin updates from the vendor is recommended to apply any forthcoming official fixes promptly.